TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7602-a47a2-1.html | Third Party Advisory |
Configurations
History
31 Jan 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| Summary | (en) TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution. |
Information
Published : 2023-12-15 09:15
Updated : 2024-01-31 03:15
NVD link : CVE-2023-48387
Mitre link : CVE-2023-48387
CVE.ORG link : CVE-2023-48387
JSON object : View
Products Affected
twca
- jcicsecuritytool